@faable/auth-sdk 2.7.81 → 2.7.83

package/dist/api/types.d.ts

@@ -1196,6 +1196,178 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/team/{team_id}/organization": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Put a Team in an Organization, or take it out
+         * @description Sets the Organization the Team belongs to (`null` = none). A team is in at most one organization; setting another one moves it. Belonging to an organization grants nobody access to the team. Emits `team.updated`.
+         */
+        put: operations["team/setOrganization"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List Organizations
+         * @description List Organizations
+         */
+        get: operations["organization/list"];
+        put?: never;
+        /**
+         * Create Organization
+         * @description Create Organization
+         */
+        post: operations["organization/create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Organization
+         * @description Get Organization
+         */
+        get: operations["organization/get"];
+        put?: never;
+        /**
+         * Update Organization
+         * @description Update Organization
+         */
+        post: operations["organization/update"];
+        /**
+         * Delete Organization
+         * @description Delete Organization
+         */
+        delete: operations["organization/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/admin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add an admin to an Organization
+         * @description Makes a user of this tenant an admin of the Organization. Idempotent. Being an admin does not grant access to any team of the organization. Emits `organization.updated`.
+         */
+        post: operations["organization/addAdmin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/admin/{user_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove an admin from an Organization
+         * @description Removes the user from the admins of the Organization (the user is not deleted). An organization keeps at least one admin: removing the last one is `last_organization_admin`. Emits `organization.updated`.
+         */
+        delete: operations["organization/removeAdmin"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/domain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Claim an email domain for an Organization
+         * @description Adds the domain unverified, with the `verification_token` its TXT record must hold. Idempotent. Nothing changes for anyone until the domain is verified.
+         */
+        post: operations["organization/addDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/domain/{domain}/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify an Organization's email domain
+         * @description Looks up the TXT record `_faable-challenge.<domain>` and, when it holds `faable-verification=<verification_token>`, marks the domain verified. Pro plan (`plan_required`; `plan_unavailable` when the plan cannot be checked). A domain is verified by one organization of the tenant at most (`organization_domain_taken`).
+         */
+        post: operations["organization/verifyDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/organization/{organization_id}/domain/{domain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove an email domain from an Organization
+         * @description Removes the domain, verified or not. Logins of people already in the organization are unaffected.
+         */
+        delete: operations["organization/removeDomain"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/teammember": {
         parameters: {
             query?: never;
@@ -4437,7 +4609,7 @@ export interface paths {
         put?: never;
         /**
          * OpenID Connect Dynamic Client Registration
-         * @description Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context.
+         * @description Register a new OAuth/OIDC client dynamically (OIDC Dynamic Client Registration 1.0 / RFC 7591). The new client is bound to the Account resolved from the request context. Only when the tenant has `dynamic_client_registration_enabled`; otherwise `registration_disabled` (403).
          */
         post: operations["oauth/register"];
         delete?: never;
@@ -4725,6 +4897,8 @@ export interface components {
             webauthn_rp_id?: string | null;
             /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
             logout_confirm_required?: boolean;
+            /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+            dynamic_client_registration_enabled?: boolean;
             /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
             canonical_host?: string | null;
             /** @description AuthAccount creation date */
@@ -5603,6 +5777,8 @@ export interface components {
             description: string | null;
             /** @description Optional URL of an image used as the team avatar/logo. */
             logo_url: string | null;
+            /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+            organization?: string | null;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -5657,6 +5833,104 @@ export interface components {
         TeamUpdateMetadata: {
             [key: string]: unknown;
         };
+        /** @description Organization */
+        Organization: {
+            /** @description Organization ID */
+            id: string;
+            /**
+             * @description Human-readable name of the organization.
+             * @example Acme Inc.
+             */
+            name: string;
+            /**
+             * @description URL-safe identifier derived from `name`. Unique within the tenant.
+             * @example acme-inc
+             */
+            slug: string;
+            /** @description Optional free-form description. */
+            description: string | null;
+            /** @description Optional URL of the organization logo. */
+            logo_url: string | null;
+            /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+            domains: {
+                /** @example acme.com */
+                domain: string;
+                /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                verification_token: string;
+                /**
+                 * Format: date-time
+                 * @description When the TXT record was found. `null` = not verified.
+                 */
+                verified_at: string | null;
+            }[];
+            /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+            admins: string[];
+            /** @description Object is related with this account */
+            account: string;
+            /**
+             * @description OrganizationMetadata
+             * @default {}
+             */
+            metadata: {
+                [key: string]: unknown;
+            };
+            /** @description Organization creation date */
+            createdAt: string;
+            /** @description Organization updated date */
+            updatedAt?: string;
+        };
+        /**
+         * @description OrganizationMetadata
+         * @default {}
+         */
+        OrganizationMetadata: {
+            [key: string]: unknown;
+        };
+        /** @description OrganizationCreate */
+        OrganizationCreate: {
+            /**
+             * @description Human-readable name of the organization.
+             * @example Acme Inc.
+             */
+            name: string;
+            /** @description Optional free-form description. */
+            description?: string;
+            /**
+             * Format: uri
+             * @description Optional URL of the organization logo.
+             */
+            logo_url?: string;
+            /** @description Initial admins (user ids of this tenant). Can be empty and filled later with `POST /organization/{organization_id}/admin`. */
+            admins?: string[];
+            /** @description Add Metadata */
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Add Metadata */
+        OrganizationMetadataCreate: {
+            [key: string]: unknown;
+        };
+        /** @description Partial update for an Organization. `slug` is derived from `name` on creation and is not editable; admins change through `/organization/{organization_id}/admin`. */
+        OrganizationUpdate: {
+            /** @description New human-readable name. */
+            name?: string;
+            /** @description New free-form description. */
+            description?: string;
+            /**
+             * Format: uri
+             * @description New URL of the organization logo.
+             */
+            logo_url?: string;
+            /** @description Arbitrary key/value pairs. Replaces the previous metadata entirely. */
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Arbitrary key/value pairs. Replaces the previous metadata entirely. */
+        OrganizationUpdateMetadata: {
+            [key: string]: unknown;
+        };
         /** @description TeamMember */
         TeamMember: {
             /** @description TeamMember ID */
@@ -6101,8 +6375,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6202,8 +6479,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6297,8 +6577,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6360,8 +6643,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events: string[];
             /** @enum {string} */
@@ -6427,8 +6713,11 @@ export interface components {
              *     - `team.invite.created`: An invitation to join a team was created.
              *     - `team.invite.revoked`: A pending team invitation was revoked.
              *     - `team.invite.accepted`: A team invitation was accepted.
+             *     - `organization.created`: An organization was created.
+             *     - `organization.updated`: An organization was updated (name, settings or admins).
+             *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
              *
-             *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+             *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
              */
             events?: string[];
             /** @enum {string} */
@@ -6827,6 +7116,7 @@ export interface components {
             default_country_iso?: string | null;
             webauthn_rp_id?: string | null;
             logout_confirm_required?: boolean | null;
+            dynamic_client_registration_enabled?: boolean | null;
             canonical_host?: string | null;
             login_flow?: string | null;
         };
@@ -7037,6 +7327,17 @@ export interface components {
          *     - `invite_used` (400): The invite was already accepted.
          *     - `already_member` (400): The user is already a member of the team.
          *     - `not_a_member` (404): The user is not a member of the team.
+         *     - `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.
+         *     - `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
+         *     - `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
+         *     - `organization_domain_not_found` (404): The organization has no such domain.
+         *     - `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.
+         *     - `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.
+         *     - `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.
+         *     - `organization_not_found` (404): No organization with that id in this account.
+         *     - `invalid_user` (400): The user does not exist in this account.
+         *     - `not_an_organization_admin` (404): The user is not an admin of the organization.
+         *     - `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.
          *     - `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.
          *     - `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.
          *     - `role_not_found` (404): No role with that id in this account.
@@ -7050,7 +7351,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -7210,6 +7511,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -7565,6 +7868,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -7808,6 +8113,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -8000,6 +8307,7 @@ export interface operations {
                     default_country_iso?: string | null;
                     webauthn_rp_id?: string | null;
                     logout_confirm_required?: boolean | null;
+                    dynamic_client_registration_enabled?: boolean | null;
                     canonical_host?: string | null;
                     login_flow?: string | null;
                 };
@@ -8126,6 +8434,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -9388,6 +9698,8 @@ export interface operations {
                         webauthn_rp_id?: string | null;
                         /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
                         logout_confirm_required?: boolean;
+                        /** @description When true, anyone can register a client with `POST /oidc/register` (OIDC Dynamic Client Registration / RFC 7591) and the discovery document advertises `registration_endpoint`. Off by default: an open registration lets anyone create a client with their own `redirect_uri`. */
+                        dynamic_client_registration_enabled?: boolean;
                         /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
                         canonical_host?: string | null;
                         /** @description AuthAccount creation date */
@@ -17708,6 +18020,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -17842,6 +18156,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18005,6 +18321,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18044,6 +18362,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18204,6 +18524,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18344,6 +18666,8 @@ export interface operations {
                         description: string | null;
                         /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -18448,50 +18772,1811 @@ export interface operations {
             };
         };
     };
-    "teammember/list": {
+    "team/setOrganization": {
         parameters: {
-            query?: {
-                /** @description Number of items per page (max 200) */
-                pageSize?: number;
-                /** @description Cursor for next page */
-                cursor?: string;
-                /** @description Cursor returned by the previous page */
-                next?: string;
-                /** @description Exact match on `user`. Equivalent to `?query=user:<value>`. */
-                user?: string;
-                /** @description Exact match on `team`. Equivalent to `?query=team:<value>`. */
-                team?: string;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
-                expand?: ("user" | "team" | "roles")[];
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                team_id: string;
+            };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Id of an Organization of this tenant, or `null` to take the team out of its organization. */
+                    organization: string | null;
+                };
+            };
+        };
         responses: {
-            /** @description Default Response */
+            /** @description Team */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        next: string | null;
-                        results: components["schemas"]["TeamMember"][];
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Id of the Organization the team belongs to, or `null`. Changed only with `PUT /team/{team_id}/organization`. */
+                        organization?: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
                     };
                 };
             };
-            /**
-             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
-             *
-             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
-             *
-             *     `search_not_supported` — This resource does not support `?search=`.
-             *
-             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `organization_not_found` — No organization with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "organization_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Full-text search across: `name`, `slug`. */
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        next: string | null;
+                        results: components["schemas"]["Organization"][];
+                    };
+                };
+            };
+            /**
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `search_not_supported` — This resource does not support `?search=`.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_query" | "invalid_expand" | "search_not_supported" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/create": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description OrganizationCreate */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Human-readable name of the organization.
+                     * @example Acme Inc.
+                     */
+                    name: string;
+                    /** @description Optional free-form description. */
+                    description?: string;
+                    /**
+                     * Format: uri
+                     * @description Optional URL of the organization logo.
+                     */
+                    logo_url?: string;
+                    /** @description Initial admins (user ids of this tenant). Can be empty and filled later with `POST /organization/{organization_id}/admin`. */
+                    admins?: string[];
+                    /** @description Add Metadata */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "invalid_expand" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for an Organization. `slug` is derived from `name` on creation and is not editable; admins change through `/organization/{organization_id}/admin`. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable name. */
+                    name?: string;
+                    /** @description New free-form description. */
+                    description?: string;
+                    /**
+                     * Format: uri
+                     * @description New URL of the organization logo.
+                     */
+                    logo_url?: string;
+                    /** @description Arbitrary key/value pairs. Replaces the previous metadata entirely. */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "already_exists" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_id` — The id in the path is not a valid id for this resource.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_id" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/addAdmin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Id of a user of this tenant.
+                     * @example user_6555fd29a1b2c3d4e5f60718
+                     */
+                    user_id: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_user` — The user does not exist in this account.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_user" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/removeAdmin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `not_an_organization_admin` — The user is not an admin of the organization.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "not_an_organization_admin" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `last_organization_admin` — An organization keeps at least one admin. Add another admin before removing this one. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "last_organization_admin";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/addDomain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description The email domain, as in `alice@<domain>`.
+                     * @example acme.com
+                     */
+                    domain: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_email_domain` — Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
+             *
+             *     `public_email_domain` — A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_email_domain" | "public_email_domain" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "organization/verifyDomain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization */
+                        organization: {
+                            /** @description Organization ID */
+                            id: string;
+                            /**
+                             * @description Human-readable name of the organization.
+                             * @example Acme Inc.
+                             */
+                            name: string;
+                            /**
+                             * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                             * @example acme-inc
+                             */
+                            slug: string;
+                            /** @description Optional free-form description. */
+                            description: string | null;
+                            /** @description Optional URL of the organization logo. */
+                            logo_url: string | null;
+                            /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                            domains: {
+                                /** @example acme.com */
+                                domain: string;
+                                /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                                verification_token: string;
+                                /**
+                                 * Format: date-time
+                                 * @description When the TXT record was found. `null` = not verified.
+                                 */
+                                verified_at: string | null;
+                            }[];
+                            /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                            admins: string[];
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description OrganizationMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description Organization creation date */
+                            createdAt: string;
+                            /** @description Organization updated date */
+                            updatedAt?: string;
+                        };
+                        /** @description `null` when the domain was already verified. */
+                        record: {
+                            /** @enum {string} */
+                            type: "TXT";
+                            host: string;
+                            expected: string;
+                            observed: string[];
+                            ok: boolean;
+                        } | null;
+                    };
+                };
+            };
+            /**
+             * @description `organization_domain_unverified` — The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.
+             *
+             *     `invalid_email_domain` — Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.
+             *
+             *     `public_email_domain` — A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_domain_unverified" | "invalid_email_domain" | "public_email_domain" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /** @description `plan_required` — The setting requires a higher plan. `message` says which. */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_required";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `organization_domain_not_found` — The organization has no such domain.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "organization_domain_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `organization_domain_taken` — Another organization of this tenant already verified this domain. A domain belongs to one organization. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_domain_taken";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+            /** @description `plan_unavailable` — The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "plan_unavailable";
+                    };
+                };
+            };
+        };
+    };
+    "organization/removeDomain": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                organization_id: string;
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Organization ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the organization.
+                         * @example Acme Inc.
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier derived from `name`. Unique within the tenant.
+                         * @example acme-inc
+                         */
+                        slug: string;
+                        /** @description Optional free-form description. */
+                        description: string | null;
+                        /** @description Optional URL of the organization logo. */
+                        logo_url: string | null;
+                        /** @description Email domains the organization claims. Only a verified one counts: it is how the organization's people are recognized. */
+                        domains: {
+                            /** @example acme.com */
+                            domain: string;
+                            /** @description Put `faable-verification=<verification_token>` in a TXT record at `_faable-challenge.<domain>`, then call `POST /organization/{organization_id}/domain/{domain}/verify`. */
+                            verification_token: string;
+                            /**
+                             * Format: date-time
+                             * @description When the TXT record was found. `null` = not verified.
+                             */
+                            verified_at: string | null;
+                        }[];
+                        /** @description Ids of the users who manage the organization: its teams and its identity settings. Being an admin does not grant access to any team; team access is team membership. */
+                        admins: string[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description OrganizationMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Organization creation date */
+                        createdAt: string;
+                        /** @description Organization updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `organization_not_found` — No organization with that id in this account.
+             *
+             *     `organization_domain_not_found` — The organization has no such domain.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "organization_not_found" | "organization_domain_not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "teammember/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Exact match on `user`. Equivalent to `?query=user:<value>`. */
+                user?: string;
+                /** @description Exact match on `team`. Equivalent to `?query=team:<value>`. */
+                team?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        next: string | null;
+                        results: components["schemas"]["TeamMember"][];
+                    };
+                };
+            };
+            /**
+             * @description `invalid_query` — The `?query=` FaableQL expression could not be parsed.
+             *
+             *     `invalid_expand` — An `?expand=` path is not allowed on this resource.
+             *
+             *     `search_not_supported` — This resource does not support `?search=`.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
                 headers: {
@@ -24211,8 +26296,11 @@ export interface operations {
                      *     - `team.invite.created`: An invitation to join a team was created.
                      *     - `team.invite.revoked`: A pending team invitation was revoked.
                      *     - `team.invite.accepted`: A team invitation was accepted.
+                     *     - `organization.created`: An organization was created.
+                     *     - `organization.updated`: An organization was updated (name, settings or admins).
+                     *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                      *
-                     *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                     *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                      */
                     events: string[];
                     /** @enum {string} */
@@ -24286,8 +26374,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -24477,8 +26568,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -24656,8 +26750,11 @@ export interface operations {
                      *     - `team.invite.created`: An invitation to join a team was created.
                      *     - `team.invite.revoked`: A pending team invitation was revoked.
                      *     - `team.invite.accepted`: A team invitation was accepted.
+                     *     - `organization.created`: An organization was created.
+                     *     - `organization.updated`: An organization was updated (name, settings or admins).
+                     *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                      *
-                     *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                     *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                      */
                     events?: string[];
                     /** @enum {string} */
@@ -24731,8 +26828,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -24928,8 +27028,11 @@ export interface operations {
                          *     - `team.invite.created`: An invitation to join a team was created.
                          *     - `team.invite.revoked`: A pending team invitation was revoked.
                          *     - `team.invite.accepted`: A team invitation was accepted.
+                         *     - `organization.created`: An organization was created.
+                         *     - `organization.updated`: An organization was updated (name, settings or admins).
+                         *     - `organization.deleted`: An organization was deleted. Its teams are no longer in any organization; no `team.updated` is sent for them.
                          *
-                         *     `team.*` payloads are notices, not state: they carry ids (`team_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
+                         *     `team.*` and `organization.*` payloads are notices, not state: they carry ids (`team_id`, `organization_id`, `user_id`, `roles`, `invite_id`...) and the receiver reads whatever else it needs. Use the delivery id (`x-faable-delivery`) to deduplicate: retries keep it.
                          */
                         events: string[];
                         /** @enum {string} */
@@ -29848,6 +31951,18 @@ export interface operations {
                     };
                 };
             };
+            /** @description `registration_disabled` — Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "registration_disabled";
+                    };
+                };
+            };
             /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {